From caeac3e96c9fd4e1a59d19104d6437f7d57134c8 Mon Sep 17 00:00:00 2001 From: icamarillo Date: Mon, 16 Feb 2026 10:59:08 -0700 Subject: [PATCH] =?UTF-8?q?Fix:=20Correcciones=20en=20an=C3=A1lisis=20de?= =?UTF-8?q?=20seguridad=20y=20middleware=20tenant?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Corregido query SQL para detección de escalada de privilegios (JSONB operator) - Añadidas rutas de autenticación faltantes al middleware tenant - Sistema completamente verificado y funcional v1.6.0 --- backend/app/api/v1/endpoints/audit.py | 2 +- backend/app/middleware/tenant.py | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/backend/app/api/v1/endpoints/audit.py b/backend/app/api/v1/endpoints/audit.py index 420ff97..2ddea5d 100644 --- a/backend/app/api/v1/endpoints/audit.py +++ b/backend/app/api/v1/endpoints/audit.py @@ -491,7 +491,7 @@ async def get_security_analysis( AuditLog.tenant_id == current_tenant.id, AuditLog.action == 'user.update', AuditLog.created_at >= analysis_start, - AuditLog.new_values.contains('"role"') + AuditLog.new_values.op('?')('role') ) ).group_by(User.email).having(func.count(AuditLog.id) >= 3) diff --git a/backend/app/middleware/tenant.py b/backend/app/middleware/tenant.py index 11aa855..45e8811 100644 --- a/backend/app/middleware/tenant.py +++ b/backend/app/middleware/tenant.py @@ -24,10 +24,17 @@ class TenantMiddleware(BaseHTTPMiddleware): EXCLUDED_PATHS = { "/health", "/", + "/api/v1/auth/login", "/v1/auth/login", "/docs", + "/api/v1/docs", + "/v1/docs", "/openapi.json", - "/redoc" + "/api/v1/openapi.json", + "/v1/openapi.json", + "/redoc", + "/api/v1/redoc", + "/v1/redoc" } async def dispatch(self, request: Request, call_next) -> Response: